d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2e4da012d5
freebsd-dev/sys/ufs/ffs/ffs_subr.c

1065 lines
32 KiB
C
Raw Normal View History

/* -> /*- for license, minor formatting changes
2005-01-07 02:29:27 +00:00
/*-
sys: further adoption of SPDX licensing ID tags. Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point.
2017-11-20 19:43:44 +00:00
* SPDX-License-Identifier: BSD-3-Clause
*
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
* Copyright (c) 1982, 1986, 1989, 1993
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
* 3. Neither the name of the University nor the names of its contributors
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
This is the kernel Lite/2 commit. There are some requisite userland changes, so don't expect to be able to run the kernel as-is (very well) without the appropriate Lite/2 userland changes. The system boots and can mount UFS filesystems. Untested: ext2fs, msdosfs, NFS Known problems: Incorrect Berkeley ID strings in some files. Mount_std mounts will not work until the getfsent library routine is changed. Reviewed by: various people Submitted by: Jeffery Hsu <hsu@freebsd.org>
1997-02-10 02:22:35 +00:00
* @(#)ffs_subr.c 8.5 (Berkeley) 3/21/95
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
*/
Use __FBSDID().
2003-06-11 06:34:30 +00:00
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <sys/param.h>
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
#include <sys/limits.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
Change #ifdef KERNEL to #ifdef _KERNEL in the public headers. "KERNEL" is an application space macro and the applications are supposed to be free to use it as they please (but cannot). This is consistant with the other BSD's who made this change quite some time ago. More commits to come.
1999-12-29 05:07:58 +00:00
#ifndef _KERNEL
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <time.h>
#include <sys/errno.h>
This is the kernel Lite/2 commit. There are some requisite userland changes, so don't expect to be able to run the kernel as-is (very well) without the appropriate Lite/2 userland changes. The system boots and can mount UFS filesystems. Untested: ext2fs, msdosfs, NFS Known problems: Incorrect Berkeley ID strings in some files. Mount_std mounts will not work until the getfsent library routine is changed. Reviewed by: various people Submitted by: Jeffery Hsu <hsu@freebsd.org>
1997-02-10 02:22:35 +00:00
#include <ufs/ufs/dinode.h>
This commit adds basic support for the UFS2 filesystem. The UFS2 filesystem expands the inode to 256 bytes to make space for 64-bit block pointers. It also adds a file-creation time field, an ability to use jumbo blocks per inode to allow extent like pointer density, and space for extended attributes (up to twice the filesystem block size worth of attributes, e.g., on a 16K filesystem, there is space for 32K of attributes). UFS2 fully supports and runs existing UFS1 filesystems. New filesystems built using newfs can be built in either UFS1 or UFS2 format using the -O option. In this commit UFS1 is the default format, so if you want to build UFS2 format filesystems, you must specify -O 2. This default will be changed to UFS2 when UFS2 proves itself to be stable. In this commit the boot code for reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c) as there is insufficient space in the boot block. Once the size of the boot block is increased, this code can be defined. Things to note: the definition of SBSIZE has changed to SBLOCKSIZE. The header file <ufs/ufs/dinode.h> must be included before <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and ufs_lbn_t. Still TODO: Verify that the first level bootstraps work for all the architectures. Convert the utility ffsinfo to understand UFS2 and test growfs. Add support for the extended attribute storage. Update soft updates to ensure integrity of extended attribute storage. Switch the current extended attribute interfaces to use the extended attribute storage. Add the extent like functionality (framework is there, but is currently never used). Sponsored by: DARPA & NAI Labs. Reviewed by: Poul-Henning Kamp <phk@freebsd.org>
2002-06-21 06:18:05 +00:00
#include <ufs/ffs/fs.h>
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
uint32_t calculate_crc32c(uint32_t, const void *, size_t);
Calculate updated superblock check-hash before writing it into the snapshot. This corrects a bug that prevented snapshots from being mounted due to a superblock check-hash failure. Reported by: Brennan Vincent <brennan@umanwizard.com> Tested by: Peter Holm (pho@) Sponsored by: Netflix
2018-11-25 18:01:15 +00:00
uint32_t ffs_calc_sbhash(struct fs *);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
struct malloc_type;
#define UFS_MALLOC(size, type, flags) malloc(size)
#define UFS_FREE(ptr, type) free(ptr)
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
#define maxphys MAXPHYS
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
#else /* _KERNEL */
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <sys/systm.h>
Separate kernel crc32() implementation to its own header (gsb_crc32.h) and rename the source to gsb_crc32.c. This is a prerequisite of unifying kernel zlib instances. PR: 229763 Submitted by: Yoshihiro Ota <ota at j.email.ne.jp> Differential Revision: https://reviews.freebsd.org/D20193
2019-06-17 19:49:08 +00:00
#include <sys/gsb_crc32.h>
Don't include <sys/lock.h> in headers when only `struct simplelock' is required. Fixed everything that depended on the pollution.
1997-12-05 19:55:52 +00:00
#include <sys/lock.h>
This commit adds basic support for the UFS2 filesystem. The UFS2 filesystem expands the inode to 256 bytes to make space for 64-bit block pointers. It also adds a file-creation time field, an ability to use jumbo blocks per inode to allow extent like pointer density, and space for extended attributes (up to twice the filesystem block size worth of attributes, e.g., on a 16K filesystem, there is space for 32K of attributes). UFS2 fully supports and runs existing UFS1 filesystems. New filesystems built using newfs can be built in either UFS1 or UFS2 format using the -O option. In this commit UFS1 is the default format, so if you want to build UFS2 format filesystems, you must specify -O 2. This default will be changed to UFS2 when UFS2 proves itself to be stable. In this commit the boot code for reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c) as there is insufficient space in the boot block. Once the size of the boot block is increased, this code can be defined. Things to note: the definition of SBSIZE has changed to SBLOCKSIZE. The header file <ufs/ufs/dinode.h> must be included before <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and ufs_lbn_t. Still TODO: Verify that the first level bootstraps work for all the architectures. Convert the utility ffsinfo to understand UFS2 and test growfs. Add support for the extended attribute storage. Update soft updates to ensure integrity of extended attribute storage. Switch the current extended attribute interfaces to use the extended attribute storage. Add the extent like functionality (framework is there, but is currently never used). Sponsored by: DARPA & NAI Labs. Reviewed by: Poul-Henning Kamp <phk@freebsd.org>
2002-06-21 06:18:05 +00:00
#include <sys/malloc.h>
#include <sys/mount.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <sys/vnode.h>
Separate the struct bio related stuff out of <sys/buf.h> into <sys/bio.h>. <sys/bio.h> is now a prerequisite for <sys/buf.h> but it shall not be made a nested include according to bdes teachings on the subject of nested includes. Diskdrivers and similar stuff below specfs::strategy() should no longer need to include <sys/buf.> unless they need caching of data. Still a few bogus uses of struct buf to track down. Repocopy by: peter
2000-05-05 09:59:14 +00:00
#include <sys/bio.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <sys/buf.h>
Moved some #includes from <sys/param.h> nearer to where they are actually used.
1998-03-28 10:33:27 +00:00
#include <sys/ucred.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <ufs/ufs/quota.h>
#include <ufs/ufs/inode.h>
This commit adds basic support for the UFS2 filesystem. The UFS2 filesystem expands the inode to 256 bytes to make space for 64-bit block pointers. It also adds a file-creation time field, an ability to use jumbo blocks per inode to allow extent like pointer density, and space for extended attributes (up to twice the filesystem block size worth of attributes, e.g., on a 16K filesystem, there is space for 32K of attributes). UFS2 fully supports and runs existing UFS1 filesystems. New filesystems built using newfs can be built in either UFS1 or UFS2 format using the -O option. In this commit UFS1 is the default format, so if you want to build UFS2 format filesystems, you must specify -O 2. This default will be changed to UFS2 when UFS2 proves itself to be stable. In this commit the boot code for reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c) as there is insufficient space in the boot block. Once the size of the boot block is increased, this code can be defined. Things to note: the definition of SBSIZE has changed to SBLOCKSIZE. The header file <ufs/ufs/dinode.h> must be included before <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and ufs_lbn_t. Still TODO: Verify that the first level bootstraps work for all the architectures. Convert the utility ffsinfo to understand UFS2 and test growfs. Add support for the extended attribute storage. Update soft updates to ensure integrity of extended attribute storage. Switch the current extended attribute interfaces to use the extended attribute storage. Add the extent like functionality (framework is there, but is currently never used). Sponsored by: DARPA & NAI Labs. Reviewed by: Poul-Henning Kamp <phk@freebsd.org>
2002-06-21 06:18:05 +00:00
#include <ufs/ufs/extattr.h>
#include <ufs/ufs/ufsmount.h>
#include <ufs/ufs/ufs_extern.h>
This is the kernel Lite/2 commit. There are some requisite userland changes, so don't expect to be able to run the kernel as-is (very well) without the appropriate Lite/2 userland changes. The system boots and can mount UFS filesystems. Untested: ext2fs, msdosfs, NFS Known problems: Incorrect Berkeley ID strings in some files. Mount_std mounts will not work until the getfsent library routine is changed. Reviewed by: various people Submitted by: Jeffery Hsu <hsu@freebsd.org>
1997-02-10 02:22:35 +00:00
#include <ufs/ffs/ffs_extern.h>
This commit adds basic support for the UFS2 filesystem. The UFS2 filesystem expands the inode to 256 bytes to make space for 64-bit block pointers. It also adds a file-creation time field, an ability to use jumbo blocks per inode to allow extent like pointer density, and space for extended attributes (up to twice the filesystem block size worth of attributes, e.g., on a 16K filesystem, there is space for 32K of attributes). UFS2 fully supports and runs existing UFS1 filesystems. New filesystems built using newfs can be built in either UFS1 or UFS2 format using the -O option. In this commit UFS1 is the default format, so if you want to build UFS2 format filesystems, you must specify -O 2. This default will be changed to UFS2 when UFS2 proves itself to be stable. In this commit the boot code for reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c) as there is insufficient space in the boot block. Once the size of the boot block is increased, this code can be defined. Things to note: the definition of SBSIZE has changed to SBLOCKSIZE. The header file <ufs/ufs/dinode.h> must be included before <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and ufs_lbn_t. Still TODO: Verify that the first level bootstraps work for all the architectures. Convert the utility ffsinfo to understand UFS2 and test growfs. Add support for the extended attribute storage. Update soft updates to ensure integrity of extended attribute storage. Switch the current extended attribute interfaces to use the extended attribute storage. Add the extent like functionality (framework is there, but is currently never used). Sponsored by: DARPA & NAI Labs. Reviewed by: Poul-Henning Kamp <phk@freebsd.org>
2002-06-21 06:18:05 +00:00
#include <ufs/ffs/fs.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
#define UFS_MALLOC(size, type, flags) malloc(size, type, flags)
#define UFS_FREE(ptr, type) free(ptr, type)
Normally when an attempt is made to mount a UFS/FFS filesystem whose superblock has a check-hash error, an error message noting the superblock check-hash failure is printed and the mount fails. The administrator then runs fsck to repair the filesystem and when successful, the filesystem can once again be mounted. This approach fails if the filesystem in question is a root filesystem from which you are trying to boot. Here, the loader fails when trying to access the filesystem to get the kernel to boot. So it is necessary to allow the loader to ignore the superblock check-hash error and make a best effort to read the kernel. The filesystem may be suffiently corrupted that the read attempt fails, but there is no harm in trying since the loader makes no attempt to write to the filesystem. Once the kernel is loaded and starts to run, it attempts to mount its root filesystem. Once again, failure means that it breaks to its prompt to ask where to get its root filesystem. Unless you have an alternate root filesystem, you are stuck. Since the root filesystem is initially mounted read-only, it is safe to make an attempt to mount the root filesystem with the failed superblock check-hash. Thus, when asked to mount a root filesystem with a failed superblock check-hash, the kernel prints a warning message that the root filesystem superblock check-hash needs repair, but notes that it is ignoring the error and proceeding. It does mark the filesystem as needing an fsck which prevents it from being enabled for writing until fsck has been run on it. The net effect is that the reboot fails to single user, but at least at that point the administrator has the tools at hand to fix the problem. Reported by: Rick Macklem (rmacklem@) Discussed with: Warner Losh (imp@) Sponsored by: Netflix
2018-12-06 00:09:39 +00:00
#endif /* _KERNEL */
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
Continuing efforts to provide hardening of FFS. This change adds a check hash to the filesystem inodes. Access attempts to files associated with an inode with an invalid check hash will fail with EINVAL (Invalid argument). Access is reestablished after an fsck is run to find and validate the inodes with invalid check-hashes. This check avoids a class of filesystem panics related to corrupted inodes. The hash is done using crc32c. Note this check-hash is for the inode itself and not any of its indirect blocks. Check-hash validation may be extended to also cover indirect block pointers, but that will be a separate (and more costly) feature. Check hashes are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-12-11 22:14:37 +00:00
/*
* Verify an inode check-hash.
*/
int
ffs_verify_dinode_ckhash(struct fs *fs, struct ufs2_dinode *dip)
{
Ensure that the inode check-hash is not left zeroed out in the case where the check-hash fails. Prior to the fix in -r342133 the inode with the zeroed out check-hash was written back to disk causing further confusion. Reported by: Gary Jennejohn (gj) Sponsored by: Netflix
2018-12-15 18:49:30 +00:00
uint32_t ckhash, save_ckhash;
Continuing efforts to provide hardening of FFS. This change adds a check hash to the filesystem inodes. Access attempts to files associated with an inode with an invalid check hash will fail with EINVAL (Invalid argument). Access is reestablished after an fsck is run to find and validate the inodes with invalid check-hashes. This check avoids a class of filesystem panics related to corrupted inodes. The hash is done using crc32c. Note this check-hash is for the inode itself and not any of its indirect blocks. Check-hash validation may be extended to also cover indirect block pointers, but that will be a separate (and more costly) feature. Check hashes are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-12-11 22:14:37 +00:00
/*
* Return success if unallocated or we are not doing inode check-hash.
*/
if (dip->di_mode == 0 || (fs->fs_metackhash & CK_INODE) == 0)
return (0);
/*
* Exclude di_ckhash from the crc32 calculation, e.g., always use
* a check-hash value of zero when calculating the check-hash.
*/
save_ckhash = dip->di_ckhash;
dip->di_ckhash = 0;
Ensure that the inode check-hash is not left zeroed out in the case where the check-hash fails. Prior to the fix in -r342133 the inode with the zeroed out check-hash was written back to disk causing further confusion. Reported by: Gary Jennejohn (gj) Sponsored by: Netflix
2018-12-15 18:49:30 +00:00
ckhash = calculate_crc32c(~0L, (void *)dip, sizeof(*dip));
Continuing efforts to provide hardening of FFS. This change adds a check hash to the filesystem inodes. Access attempts to files associated with an inode with an invalid check hash will fail with EINVAL (Invalid argument). Access is reestablished after an fsck is run to find and validate the inodes with invalid check-hashes. This check avoids a class of filesystem panics related to corrupted inodes. The hash is done using crc32c. Note this check-hash is for the inode itself and not any of its indirect blocks. Check-hash validation may be extended to also cover indirect block pointers, but that will be a separate (and more costly) feature. Check hashes are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-12-11 22:14:37 +00:00
dip->di_ckhash = save_ckhash;
Ensure that the inode check-hash is not left zeroed out in the case where the check-hash fails. Prior to the fix in -r342133 the inode with the zeroed out check-hash was written back to disk causing further confusion. Reported by: Gary Jennejohn (gj) Sponsored by: Netflix
2018-12-15 18:49:30 +00:00
if (save_ckhash == ckhash)
return (0);
return (EINVAL);
Continuing efforts to provide hardening of FFS. This change adds a check hash to the filesystem inodes. Access attempts to files associated with an inode with an invalid check hash will fail with EINVAL (Invalid argument). Access is reestablished after an fsck is run to find and validate the inodes with invalid check-hashes. This check avoids a class of filesystem panics related to corrupted inodes. The hash is done using crc32c. Note this check-hash is for the inode itself and not any of its indirect blocks. Check-hash validation may be extended to also cover indirect block pointers, but that will be a separate (and more costly) feature. Check hashes are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-12-11 22:14:37 +00:00
}
/*
* Update an inode check-hash.
*/
void
ffs_update_dinode_ckhash(struct fs *fs, struct ufs2_dinode *dip)
{
if (dip->di_mode == 0 || (fs->fs_metackhash & CK_INODE) == 0)
return;
/*
* Exclude old di_ckhash from the crc32 calculation, e.g., always use
* a check-hash value of zero when calculating the new check-hash.
*/
dip->di_ckhash = 0;
dip->di_ckhash = calculate_crc32c(~0L, (void *)dip, sizeof(*dip));
}
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
/*
* These are the low-level functions that actually read and write
* the superblock and its associated data.
*/
static off_t sblock_try[] = SBLOCKSEARCH;
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
static int readsuper(void *, struct fs **, off_t, int,
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
int (*)(void *, off_t, void **, int));
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
static int validate_sblock(struct fs *, int);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
/*
* Read a superblock from the devfd device.
*
* If an alternate superblock is specified, it is read. Otherwise the
* set of locations given in the SBLOCKSEARCH list is searched for a
* superblock. Memory is allocated for the superblock by the readfunc and
* is returned. If filltype is non-NULL, additional memory is allocated
* of type filltype and filled in with the superblock summary information.
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
* All memory is freed when any error is returned.
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
*
* If a superblock is found, zero is returned. Otherwise one of the
* following error values is returned:
* EIO: non-existent or truncated superblock.
* EIO: error reading summary information.
* ENOENT: no usable known superblock found.
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
* ENOMEM: failed to allocate space for the superblock.
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
* EINVAL: The previous newfs operation on this volume did not complete.
* The administrator must complete newfs before using this volume.
*/
int
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
ffs_sbget(void *devfd, struct fs **fsp, off_t sblock, int flags,
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
struct malloc_type *filltype,
int (*readfunc)(void *devfd, off_t loc, void **bufp, int size))
{
struct fs *fs;
Move the pointers stored in the superblock into a separate fs_summary_info structure. This change was originally done by the CheriBSD project as they need larger pointers that do not fit in the existing superblock. This cleanup of the superblock eases the task of the commit that immediately follows this one. Suggested by: brooks Reviewed by: kib PR: 246983 Sponsored by: Netflix
2020-06-19 01:02:53 +00:00
struct fs_summary_info *fs_si;
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
int i, error;
uint64_t size, blks;
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
uint8_t *space;
int32_t *lp;
char *buf;
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
fs = NULL;
Fix a memory leak introduced in r328426. ffs_sbget() may return a superblock buffer even if it fails, so the caller must be prepared to free it in this case. Moreover, when tasting alternate superblock locations in a loop, ffs_sbget()'s readfunc callback must free the previously allocated buffer. Reported and tested by: pho Reviewed by: kib (previous version) Differential Revision: https://reviews.freebsd.org/D14390
2018-02-16 15:41:03 +00:00
*fsp = NULL;
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if (sblock != UFS_STDSB) {
if ((error = readsuper(devfd, &fs, sblock,
flags | UFS_ALTSBLK, readfunc)) != 0) {
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
if (fs != NULL)
UFS_FREE(fs, filltype);
Relax the location restraints when validating one of the backup superblocks.
2018-02-24 03:33:46 +00:00
return (error);
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
}
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
} else {
for (i = 0; sblock_try[i] != -1; i++) {
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if ((error = readsuper(devfd, &fs, sblock_try[i],
flags, readfunc)) == 0) {
if ((flags & UFS_NOCSUM) != 0) {
*fsp = fs;
return (0);
}
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
break;
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
}
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
if (fs != NULL) {
UFS_FREE(fs, filltype);
fs = NULL;
}
Relax the location restraints when validating one of the backup superblocks.
2018-02-24 03:33:46 +00:00
if (error == ENOENT)
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
continue;
Relax the location restraints when validating one of the backup superblocks.
2018-02-24 03:33:46 +00:00
return (error);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
}
if (sblock_try[i] == -1)
return (ENOENT);
}
/*
* Read in the superblock summary information.
*/
size = fs->fs_cssize;
blks = howmany(size, fs->fs_fsize);
if (fs->fs_contigsumsize > 0)
size += fs->fs_ncg * sizeof(int32_t);
size += fs->fs_ncg * sizeof(u_int8_t);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
if ((fs_si = UFS_MALLOC(sizeof(*fs_si), filltype, M_NOWAIT)) == NULL) {
Move the pointers stored in the superblock into a separate fs_summary_info structure. This change was originally done by the CheriBSD project as they need larger pointers that do not fit in the existing superblock. This cleanup of the superblock eases the task of the commit that immediately follows this one. Suggested by: brooks Reviewed by: kib PR: 246983 Sponsored by: Netflix
2020-06-19 01:02:53 +00:00
UFS_FREE(fs, filltype);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
return (ENOMEM);
Move the pointers stored in the superblock into a separate fs_summary_info structure. This change was originally done by the CheriBSD project as they need larger pointers that do not fit in the existing superblock. This cleanup of the superblock eases the task of the commit that immediately follows this one. Suggested by: brooks Reviewed by: kib PR: 246983 Sponsored by: Netflix
2020-06-19 01:02:53 +00:00
}
bzero(fs_si, sizeof(*fs_si));
fs->fs_si = fs_si;
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
if ((space = UFS_MALLOC(size, filltype, M_NOWAIT)) == NULL) {
Move the pointers stored in the superblock into a separate fs_summary_info structure. This change was originally done by the CheriBSD project as they need larger pointers that do not fit in the existing superblock. This cleanup of the superblock eases the task of the commit that immediately follows this one. Suggested by: brooks Reviewed by: kib PR: 246983 Sponsored by: Netflix
2020-06-19 01:02:53 +00:00
UFS_FREE(fs->fs_si, filltype);
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
UFS_FREE(fs, filltype);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
return (ENOMEM);
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
}
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
fs->fs_csp = (struct csum *)space;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
if (i + fs->fs_frag > blks)
size = (blks - i) * fs->fs_fsize;
Fix a memory leak introduced in r328426. ffs_sbget() may return a superblock buffer even if it fails, so the caller must be prepared to free it in this case. Moreover, when tasting alternate superblock locations in a loop, ffs_sbget()'s readfunc callback must free the previously allocated buffer. Reported and tested by: pho Reviewed by: kib (previous version) Differential Revision: https://reviews.freebsd.org/D14390
2018-02-16 15:41:03 +00:00
buf = NULL;
Relax the location restraints when validating one of the backup superblocks.
2018-02-24 03:33:46 +00:00
error = (*readfunc)(devfd,
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
dbtob(fsbtodb(fs, fs->fs_csaddr + i)), (void **)&buf, size);
Relax the location restraints when validating one of the backup superblocks.
2018-02-24 03:33:46 +00:00
if (error) {
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
if (buf != NULL)
UFS_FREE(buf, filltype);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
UFS_FREE(fs->fs_csp, filltype);
Move the pointers stored in the superblock into a separate fs_summary_info structure. This change was originally done by the CheriBSD project as they need larger pointers that do not fit in the existing superblock. This cleanup of the superblock eases the task of the commit that immediately follows this one. Suggested by: brooks Reviewed by: kib PR: 246983 Sponsored by: Netflix
2020-06-19 01:02:53 +00:00
UFS_FREE(fs->fs_si, filltype);
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
UFS_FREE(fs, filltype);
Relax the location restraints when validating one of the backup superblocks.
2018-02-24 03:33:46 +00:00
return (error);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
}
memcpy(space, buf, size);
UFS_FREE(buf, filltype);
space += size;
}
if (fs->fs_contigsumsize > 0) {
fs->fs_maxcluster = lp = (int32_t *)space;
for (i = 0; i < fs->fs_ncg; i++)
*lp++ = fs->fs_contigsumsize;
space = (uint8_t *)lp;
}
size = fs->fs_ncg * sizeof(u_int8_t);
fs->fs_contigdirs = (u_int8_t *)space;
bzero(fs->fs_contigdirs, size);
This change is some refactoring of Mark Johnston's changes in r329375 to fix the memory leak that I introduced in r328426. Instead of trying to clear up the possible memory leak in all the clients, I ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures that memory is always freed if it returns an error). The original change in r328426 was a bit sparse in its description. So I am expanding on its description here (thanks cem@ and rgrimes@ for your encouragement for my longer commit messages). In preparation for adding check hashing to superblocks, r328426 is a refactoring of the code to get the reading/writing of the superblock into one place. Unlike the cylinder group reading/writing which ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel and cgget/cgput in libufs), I have the core superblock functions just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is already imported into utilities like fsck_ffs as well as libufs to implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions take a function pointer to do the actual I/O for which there are four variants: ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem g_use_g_read_data / g_use_g_write_data for kernel geom clients ufs_use_sa_read for the standalone code (stand/libsa/ufs.c but not stand/libsa/ufsread.c which is size constrained) use_pread / use_pwrite for libufs Uses of these interfaces are in the UFS filesystem, geoms journal & label, libsa changes, and libufs. They also permeate out into the filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck, fsirand, fstyp, and quot. Some of these utilities should probably be converted to directly use libufs (like dumpfs was for example), but there does not seem to be much win in doing so. Tested by: Peter Holm (pho@)
2018-03-02 04:34:53 +00:00
*fsp = fs;
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
return (0);
}
/*
* Try to read a superblock from the location specified by sblockloc.
* Return zero on success or an errno on failure.
*/
static int
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
readsuper(void *devfd, struct fs **fsp, off_t sblockloc, int flags,
int (*readfunc)(void *devfd, off_t loc, void **bufp, int size))
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
{
struct fs *fs;
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
int error, res;
uint32_t ckhash;
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
error = (*readfunc)(devfd, sblockloc, (void **)fsp, SBLOCKSIZE);
if (error != 0)
return (error);
fs = *fsp;
if (fs->fs_magic == FS_BAD_MAGIC)
return (EINVAL);
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. A better fix to commit 9e1f44d044a. Rather than coping with the case where a backup superblock is used, catch the case when the superblock is being read in and ensure that the standard one is used rather than the backup one.
2022-07-21 05:51:15 +00:00
/*
* For UFS1 with a 65536 block size, the first backup superblock
* is at the same location as the UFS2 superblock. Since SBLOCK_UFS2
* is the first location checked, the first backup is the superblock
* that will be accessed. Here we fail the lookup so that we can
* retry with the correct location for the UFS1 superblock.
*/
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if (fs->fs_magic == FS_UFS1_MAGIC && (flags & UFS_ALTSBLK) == 0 &&
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. A better fix to commit 9e1f44d044a. Rather than coping with the case where a backup superblock is used, catch the case when the superblock is being read in and ensure that the standard one is used rather than the backup one.
2022-07-21 05:51:15 +00:00
fs->fs_bsize == SBLOCK_UFS2 && sblockloc == SBLOCK_UFS2)
return (ENOENT);
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if ((error = validate_sblock(fs, flags)) > 0)
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
return (error);
Reduce code nesting in readsuper(). No functional change.
2022-05-15 22:01:14 +00:00
/*
* If the filesystem has been run on a kernel without
* metadata check hashes, disable them.
*/
if ((fs->fs_flags & FS_METACKHASH) == 0)
fs->fs_metackhash = 0;
/*
* Clear any check-hashes that are not maintained
* by this kernel. Also clear any unsupported flags.
*/
fs->fs_metackhash &= CK_SUPPORTED;
fs->fs_flags &= FS_SUPPORTED;
if (fs->fs_ckhash != (ckhash = ffs_calc_sbhash(fs))) {
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if ((flags & (UFS_NOMSG | UFS_NOHASHFAIL)) ==
(UFS_NOMSG | UFS_NOHASHFAIL))
Reduce code nesting in readsuper(). No functional change.
2022-05-15 22:01:14 +00:00
return (0);
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if ((flags & UFS_NOMSG) != 0)
return (EINTEGRITY);
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
#ifdef _KERNEL
Reduce code nesting in readsuper(). No functional change.
2022-05-15 22:01:14 +00:00
res = uprintf("Superblock check-hash failed: recorded "
"check-hash 0x%x != computed check-hash 0x%x%s\n",
fs->fs_ckhash, ckhash,
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
(flags & UFS_NOHASHFAIL) != 0 ? " (Ignored)" : "");
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
#else
Reduce code nesting in readsuper(). No functional change.
2022-05-15 22:01:14 +00:00
res = 0;
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
#endif
Reduce code nesting in readsuper(). No functional change.
2022-05-15 22:01:14 +00:00
/*
* Print check-hash failure if no controlling terminal
* in kernel or always if in user-mode (libufs).
*/
if (res == 0)
printf("Superblock check-hash failed: recorded "
"check-hash 0x%x != computed check-hash "
"0x%x%s\n", fs->fs_ckhash, ckhash,
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
(flags & UFS_NOHASHFAIL) ? " (Ignored)" : "");
if ((flags & UFS_NOHASHFAIL) != 0)
return (0);
return (EINTEGRITY);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
}
Reduce code nesting in readsuper(). No functional change.
2022-05-15 22:01:14 +00:00
/* Have to set for old filesystems that predate this field */
fs->fs_sblockactualloc = sblockloc;
/* Not yet any summary information */
fs->fs_si = NULL;
return (0);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
}
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
/*
* Verify the filesystem values.
*/
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
#define ILOG2(num) (fls(num) - 1)
stand: Compile out the extensive superblock diagnostic messages for BIOS loader The BIOS loader operates in a very constrained environment. The messages for the super block integrity tests take up about 12k of space. Compile them out for the BIOS loader, while leaving it intact for all other loaders that aren't space constrained. These aren't used in the 'super tiny' *boot* programs, so no adjustment is needed there. We reply on the fact that (a) i386 doesn't support 32-bit UEFI booting and (b) LIBSA_CPUARCH is "i386" when building on both i386 and when we're building the 32-bit libsa32 library. This saves about 12k of space for this constrained envrionment and will take a bit of the pressure off some machines where the loader has grown too big for their BIOS (see comments in i386/loader/Makefile for details). Sponsored by: Netflix Reviewed by: mckusick Differential Revision: https://reviews.freebsd.org/D36175
2022-08-12 17:08:36 +00:00
#ifdef STANDALONE_SMALL
#define MPRINT(...) do { } while (0)
#else
#define MPRINT(...) if (prtmsg) printf(__VA_ARGS__)
#endif
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
#define FCHK(lhs, op, rhs, fmt) \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
if (lhs op rhs) { \
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
MPRINT("UFS%d superblock failed: %s (" #fmt ") %s %s (" \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
#fmt ")\n", fs->fs_magic == FS_UFS1_MAGIC ? 1 : 2, \
#lhs, (intmax_t)lhs, #op, #rhs, (intmax_t)rhs); \
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
if (error < 0) \
return (ENOENT); \
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if (error == 0) \
error = ENOENT; \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
}
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
#define WCHK(lhs, op, rhs, fmt) \
if (lhs op rhs) { \
MPRINT("UFS%d superblock failed: %s (" #fmt ") %s %s (" \
#fmt ")%s\n", fs->fs_magic == FS_UFS1_MAGIC ? 1 : 2,\
#lhs, (intmax_t)lhs, #op, #rhs, (intmax_t)rhs, wmsg);\
if (error == 0) \
error = warnerr; \
}
#define FCHK2(lhs1, op1, rhs1, lhs2, op2, rhs2, fmt) \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
if (lhs1 op1 rhs1 && lhs2 op2 rhs2) { \
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
MPRINT("UFS%d superblock failed: %s (" #fmt ") %s %s (" \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
#fmt ") && %s (" #fmt ") %s %s (" #fmt ")\n", \
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
fs->fs_magic == FS_UFS1_MAGIC ? 1 : 2, #lhs1, \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
(intmax_t)lhs1, #op1, #rhs1, (intmax_t)rhs1, #lhs2, \
(intmax_t)lhs2, #op2, #rhs2, (intmax_t)rhs2); \
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
if (error < 0) \
return (ENOENT); \
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
if (error == 0) \
error = ENOENT; \
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
}
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
#define WCHK2(lhs1, op1, rhs1, lhs2, op2, rhs2, fmt) \
if (lhs1 op1 rhs1 && lhs2 op2 rhs2) { \
MPRINT("UFS%d superblock failed: %s (" #fmt ") %s %s (" \
#fmt ") && %s (" #fmt ") %s %s (" #fmt ")%s\n", \
fs->fs_magic == FS_UFS1_MAGIC ? 1 : 2, #lhs1, \
(intmax_t)lhs1, #op1, #rhs1, (intmax_t)rhs1, #lhs2, \
(intmax_t)lhs2, #op2, #rhs2, (intmax_t)rhs2, wmsg); \
if (error == 0) \
error = warnerr; \
}
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
static int
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
validate_sblock(struct fs *fs, int flags)
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
{
Updates to UFS/FFS superblock integrity checks when reading a superblock. Reorder a few checks to ensure fields have been checked before using them to check other fields. Add eight new checks mostly checking for non-negative values. No legitimate superblocks should fail as a result of these changes.
2022-07-30 01:01:46 +00:00
u_long i, sectorsize;
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. The tests for number of cylinder groups (fs_ncg), inodes per cylinder group (fs_ipg), and the size and layout of the cylinder group summary information (fs_csaddr and fs_cssize) were overly restrictive and would exclude some valid filesystems. These updates avoid precluding valid fiesystems while still detecting rogue values that can crash or hang the kernel. Reported by: Chuck Silvers Tested by: Peter Holm MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-07-06 20:28:07 +00:00
u_int64_t maxfilesize, sizepb;
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
int error, prtmsg, warnerr;
char *wmsg;
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
error = 0;
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
sectorsize = dbtob(1);
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
prtmsg = ((flags & UFS_NOMSG) == 0);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
warnerr = (flags & UFS_NOWARNFAIL) == UFS_NOWARNFAIL ? 0 : ENOENT;
wmsg = warnerr ? "" : " (Ignored)";
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
/*
* If just validating for recovery, then do just the minimal
* checks needed for the superblock fields needed to find
* alternate superblocks.
*/
if ((flags & UFS_FSRONLY) == UFS_FSRONLY &&
(fs->fs_magic == FS_UFS1_MAGIC || fs->fs_magic == FS_UFS2_MAGIC)) {
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
error = -1; /* fail on first error */
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
if (fs->fs_magic == FS_UFS2_MAGIC) {
FCHK(fs->fs_sblockloc, !=, SBLOCK_UFS2, %#jx);
} else if (fs->fs_magic == FS_UFS1_MAGIC) {
FCHK(fs->fs_sblockloc, <, 0, %jd);
FCHK(fs->fs_sblockloc, >, SBLOCK_UFS1, %jd);
}
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_sbsize, >, SBLOCKSIZE, %jd);
FCHK(fs->fs_sbsize, <, (signed)sizeof(struct fs), %jd);
FCHK(fs->fs_sbsize % fs->fs_fsize, !=, 0, %jd);
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
FCHK(fs->fs_frag, <, 1, %jd);
FCHK(fs->fs_frag, >, MAXFRAG, %jd);
FCHK(fs->fs_bsize, <, MINBSIZE, %jd);
FCHK(fs->fs_bsize, >, MAXBSIZE, %jd);
FCHK(fs->fs_bsize, <, roundup(sizeof(struct fs), DEV_BSIZE),
%jd);
FCHK(fs->fs_fsize, <, sectorsize, %jd);
FCHK(fs->fs_fsize * fs->fs_frag, !=, fs->fs_bsize, %jd);
FCHK(powerof2(fs->fs_fsize), ==, 0, %jd);
FCHK(fs->fs_fpg, <, 3 * fs->fs_frag, %jd);
FCHK(fs->fs_ncg, <, 1, %jd);
FCHK(fs->fs_fsbtodb, !=, ILOG2(fs->fs_fsize / sectorsize), %jd);
FCHK(fs->fs_old_cgoffset, <, 0, %jd);
FCHK2(fs->fs_old_cgoffset, >, 0, ~fs->fs_old_cgmask, <, 0, %jd);
FCHK(fs->fs_old_cgoffset * (~fs->fs_old_cgmask), >, fs->fs_fpg,
%jd);
FCHK(fs->fs_sblkno, !=, roundup(
howmany(fs->fs_sblockloc + SBLOCKSIZE, fs->fs_fsize),
fs->fs_frag), %jd);
return (error);
}
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
if (fs->fs_magic == FS_UFS2_MAGIC) {
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on analysis of the way the fields are used in the various filesystem macros defined in fs.h. Eliminate several checks for non-negative values where the fields are checked for specific values. Since these specific values are non-negative, if the value is a verified positive value then it cannot be negative and such a check is redundant and unnecessary. No legitimate superblocks should fail as a result of these changes.
2022-08-01 03:28:04 +00:00
if ((flags & UFS_ALTSBLK) == 0)
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK2(fs->fs_sblockactualloc, !=, SBLOCK_UFS2,
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
fs->fs_sblockactualloc, !=, 0, %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_sblockloc, !=, SBLOCK_UFS2, %#jx);
FCHK(fs->fs_maxsymlinklen, !=, ((UFS_NDADDR + UFS_NIADDR) *
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
sizeof(ufs2_daddr_t)), %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_nindir, !=, fs->fs_bsize / sizeof(ufs2_daddr_t),
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
%jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_inopb, !=,
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on analysis of the way the fields are used in the various filesystem macros defined in fs.h. Eliminate several checks for non-negative values where the fields are checked for specific values. Since these specific values are non-negative, if the value is a verified positive value then it cannot be negative and such a check is redundant and unnecessary. No legitimate superblocks should fail as a result of these changes.
2022-08-01 03:28:04 +00:00
fs->fs_bsize / sizeof(struct ufs2_dinode), %jd);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
} else if (fs->fs_magic == FS_UFS1_MAGIC) {
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on analysis of the way the fields are used in the various filesystem macros defined in fs.h. Eliminate several checks for non-negative values where the fields are checked for specific values. Since these specific values are non-negative, if the value is a verified positive value then it cannot be negative and such a check is redundant and unnecessary. No legitimate superblocks should fail as a result of these changes.
2022-08-01 03:28:04 +00:00
if ((flags & UFS_ALTSBLK) == 0)
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_sblockactualloc, >, SBLOCK_UFS1, %jd);
FCHK(fs->fs_sblockloc, <, 0, %jd);
FCHK(fs->fs_sblockloc, >, SBLOCK_UFS1, %jd);
FCHK(fs->fs_nindir, !=, fs->fs_bsize / sizeof(ufs1_daddr_t),
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
%jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_inopb, !=,
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on analysis of the way the fields are used in the various filesystem macros defined in fs.h. Eliminate several checks for non-negative values where the fields are checked for specific values. Since these specific values are non-negative, if the value is a verified positive value then it cannot be negative and such a check is redundant and unnecessary. No legitimate superblocks should fail as a result of these changes.
2022-08-01 03:28:04 +00:00
fs->fs_bsize / sizeof(struct ufs1_dinode), %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_maxsymlinklen, !=, ((UFS_NDADDR + UFS_NIADDR) *
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
sizeof(ufs1_daddr_t)), %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_old_inodefmt, !=, FS_44INODEFMT, %jd);
WCHK(fs->fs_old_rotdelay, !=, 0, %jd);
WCHK(fs->fs_old_rps, !=, 60, %jd);
WCHK(fs->fs_old_nspf, !=, fs->fs_fsize / sectorsize, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_old_cpg, !=, 1, %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_old_interleave, !=, 1, %jd);
WCHK(fs->fs_old_trackskew, !=, 0, %jd);
WCHK(fs->fs_old_cpc, !=, 0, %jd);
WCHK(fs->fs_old_postblformat, !=, 1, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_old_nrpos, !=, 1, %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_old_spc, !=, fs->fs_fpg * fs->fs_old_nspf, %jd);
WCHK(fs->fs_old_nsect, !=, fs->fs_old_spc, %jd);
WCHK(fs->fs_old_npsect, !=, fs->fs_old_spc, %jd);
FCHK(fs->fs_old_ncyl, !=, fs->fs_ncg, %jd);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
} else {
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
/* Bad magic number, so assume not a superblock */
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
return (ENOENT);
}
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_bsize, <, MINBSIZE, %jd);
FCHK(fs->fs_bsize, >, MAXBSIZE, %jd);
FCHK(fs->fs_bsize, <, roundup(sizeof(struct fs), DEV_BSIZE), %jd);
FCHK(powerof2(fs->fs_bsize), ==, 0, %jd);
FCHK(fs->fs_frag, <, 1, %jd);
FCHK(fs->fs_frag, >, MAXFRAG, %jd);
FCHK(fs->fs_frag, !=, numfrags(fs, fs->fs_bsize), %jd);
FCHK(fs->fs_fsize, <, sectorsize, %jd);
FCHK(fs->fs_fsize * fs->fs_frag, !=, fs->fs_bsize, %jd);
FCHK(powerof2(fs->fs_fsize), ==, 0, %jd);
FCHK(fs->fs_fpg, <, 3 * fs->fs_frag, %jd);
FCHK(fs->fs_ncg, <, 1, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_ipg, <, fs->fs_inopb, %jd);
FCHK(fs->fs_ipg % fs->fs_inopb, !=, 0, %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_ipg * fs->fs_ncg, >, (((int64_t)(1)) << 32) - INOPB(fs),
Updates to UFS/FFS superblock integrity checks when reading a superblock. Reorder a few checks to ensure fields have been checked before using them to check other fields. Add eight new checks mostly checking for non-negative values. No legitimate superblocks should fail as a result of these changes.
2022-07-30 01:01:46 +00:00
%jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_cstotal.cs_nifree, <, 0, %jd);
FCHK(fs->fs_cstotal.cs_nifree, >, fs->fs_ipg * fs->fs_ncg, %jd);
FCHK(fs->fs_cstotal.cs_ndir, <, 0, %jd);
FCHK(fs->fs_cstotal.cs_ndir, >,
(fs->fs_ipg * fs->fs_ncg) - fs->fs_cstotal.cs_nifree, %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_sbsize, >, SBLOCKSIZE, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_sbsize, <, (signed)sizeof(struct fs), %jd);
FCHK(fs->fs_sbsize % fs->fs_fsize, !=, 0, %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_maxbsize, <, fs->fs_bsize, %jd);
FCHK(powerof2(fs->fs_maxbsize), ==, 0, %jd);
FCHK(fs->fs_maxbsize, >, FS_MAXCONTIG * fs->fs_bsize, %jd);
FCHK(fs->fs_bmask, !=, ~(fs->fs_bsize - 1), %#jx);
FCHK(fs->fs_fmask, !=, ~(fs->fs_fsize - 1), %#jx);
FCHK(fs->fs_qbmask, !=, ~fs->fs_bmask, %#jx);
FCHK(fs->fs_qfmask, !=, ~fs->fs_fmask, %#jx);
FCHK(fs->fs_bshift, !=, ILOG2(fs->fs_bsize), %jd);
FCHK(fs->fs_fshift, !=, ILOG2(fs->fs_fsize), %jd);
FCHK(fs->fs_fragshift, !=, ILOG2(fs->fs_frag), %jd);
FCHK(fs->fs_fsbtodb, !=, ILOG2(fs->fs_fsize / sectorsize), %jd);
FCHK(fs->fs_old_cgoffset, <, 0, %jd);
FCHK2(fs->fs_old_cgoffset, >, 0, ~fs->fs_old_cgmask, <, 0, %jd);
FCHK(fs->fs_old_cgoffset * (~fs->fs_old_cgmask), >, fs->fs_fpg, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
/*
* If anything has failed up to this point, it is usafe to proceed
* as checks below may divide by zero or make other fatal calculations.
* So if we have any errors at this point, give up.
*/
if (error)
return (error);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_sblkno, !=, roundup(
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
howmany(fs->fs_sblockloc + SBLOCKSIZE, fs->fs_fsize),
fs->fs_frag), %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_cblkno, !=, fs->fs_sblkno +
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
roundup(howmany(SBLOCKSIZE, fs->fs_fsize), fs->fs_frag), %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_iblkno, !=, fs->fs_cblkno + fs->fs_frag, %jd);
FCHK(fs->fs_dblkno, !=, fs->fs_iblkno + fs->fs_ipg / INOPF(fs), %jd);
FCHK(fs->fs_cgsize, >, fs->fs_bsize, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_cgsize, <, fs->fs_fsize, %jd);
FCHK(fs->fs_cgsize % fs->fs_fsize, !=, 0, %jd);
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. Older versions of growfs(8) failed to correctly update fs_dsize. Filesystems that have been grown fail the test for fs_dsize's correct value. For now we exclude the fs_dsize test from the requirements. Reported by: Edward Tomasz Napiera Tested by: Edward Tomasz Napiera Tested by: Peter Holm MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-07-06 21:38:19 +00:00
/*
* This test is valid, however older versions of growfs failed
* to correctly update fs_dsize so will fail this test. Thus we
* exclude it from the requirements.
*/
#ifdef notdef
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_dsize, !=, fs->fs_size - fs->fs_sblkno -
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
fs->fs_ncg * (fs->fs_dblkno - fs->fs_sblkno) -
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
howmany(fs->fs_cssize, fs->fs_fsize), %jd);
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. Older versions of growfs(8) failed to correctly update fs_dsize. Filesystems that have been grown fail the test for fs_dsize's correct value. For now we exclude the fs_dsize test from the requirements. Reported by: Edward Tomasz Napiera Tested by: Edward Tomasz Napiera Tested by: Peter Holm MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-07-06 21:38:19 +00:00
#endif
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_metaspace, <, 0, %jd);
WCHK(fs->fs_metaspace, >, fs->fs_fpg / 2, %jd);
WCHK(fs->fs_minfree, >, 99, %jd%%);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
maxfilesize = fs->fs_bsize * UFS_NDADDR - 1;
for (sizepb = fs->fs_bsize, i = 0; i < UFS_NIADDR; i++) {
sizepb *= NINDIR(fs);
maxfilesize += sizepb;
}
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_maxfilesize, !=, maxfilesize, %jd);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
/*
* These values have a tight interaction with each other that
* makes it hard to tightly bound them. So we can only check
* that they are within a broader possible range.
*
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. The tests for number of cylinder groups (fs_ncg), inodes per cylinder group (fs_ipg), and the size and layout of the cylinder group summary information (fs_csaddr and fs_cssize) were overly restrictive and would exclude some valid filesystems. These updates avoid precluding valid fiesystems while still detecting rogue values that can crash or hang the kernel. Reported by: Chuck Silvers Tested by: Peter Holm MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-07-06 20:28:07 +00:00
* The size cannot always be accurately determined, but ensure
* that it is consistent with the number of cylinder groups (fs_ncg)
* and the number of fragments per cylinder group (fs_fpg). Ensure
* that the summary information size is correct and that it starts
* and ends in the data area of the same cylinder group.
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
*/
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_size, <, 8 * fs->fs_frag, %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK(fs->fs_size, <=, (fs->fs_ncg - 1) * fs->fs_fpg, %jd);
FCHK(fs->fs_size, >, fs->fs_ncg * fs->fs_fpg, %jd);
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
/*
* If we are not requested to read in the csum data stop here
* as the correctness of the remaining values is only important
* to bound the space needed to be allocated to hold the csum data.
*/
if ((flags & UFS_NOCSUM) != 0)
return (error);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(fs->fs_csaddr, <, 0, %jd);
FCHK(fs->fs_cssize, !=,
Bug fix to UFS/FFS superblock integrity checks when reading a superblock. The tests for number of cylinder groups (fs_ncg), inodes per cylinder group (fs_ipg), and the size and layout of the cylinder group summary information (fs_csaddr and fs_cssize) were overly restrictive and would exclude some valid filesystems. These updates avoid precluding valid fiesystems while still detecting rogue values that can crash or hang the kernel. Reported by: Chuck Silvers Tested by: Peter Holm MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-07-06 20:28:07 +00:00
fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd);
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
FCHK(dtog(fs, fs->fs_csaddr), >, fs->fs_ncg, %jd);
FCHK(fs->fs_csaddr, <, cgdmin(fs, dtog(fs, fs->fs_csaddr)), %jd);
FCHK(dtog(fs, fs->fs_csaddr + howmany(fs->fs_cssize, fs->fs_fsize)), >,
Updates to UFS/FFS superblock integrity checks when reading a superblock. Reorder a few checks to ensure fields have been checked before using them to check other fields. Add eight new checks mostly checking for non-negative values. No legitimate superblocks should fail as a result of these changes.
2022-07-30 01:01:46 +00:00
dtog(fs, fs->fs_csaddr), %jd);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
/*
Two bug fixes to UFS/FFS superblock integrity checks when reading a superblock. Two bugs have been reported with the UFS/FFS superblock integrity checks that were added in commit 076002f24d35. The code checked that fs_sblockactualloc was properly set to the location of the superblock. The fs_sblockactualloc field was an addition to the superblock in commit dffce2150eea on Jan 26 2018 and used a field that was zero in filesystems created before it was added. The integrity check had to be expanded to accept the fs_sblockactualloc field being zero so as not to reject filesystems created before Jan 26 2018. The integrity check set an upper bound on the value of fs_maxcontig based on the maximum transfer size supported by the kernel. It required that fs->fs_maxcontig <= maxphys / fs->fs_bsize. The kernel variable maxphys defines the maximum transfer size permitted by the controllers and/or buffering. The fs_maxcontig parameter controls the maximum number of blocks that the filesystem will read or write in a single transfer. It is calculated when the filesystem is created as maxphys / fs_bsize. The bug appeared in the loader because it uses a maxphys of 128K even when running on a system that supports larger values. If the filesystem was built on a system that supports a larger maxphys (1M is typical) it will have configured fs_maxcontig for that larger system so would fail the test when run with the smaller maxphys used by the loader. So we bound the upper allowable limit for fs_maxconfig to be able to at least work with a 1M maxphys on the smallest block size filesystem: 1M / 4096 == 256. We then use the limit for fs_maxcontig as fs_maxcontig <= MAX(256, maxphys / fs_bsize). There is no harm in allowing the mounting of filesystems that make larger than maxphys I/O requests because those (mostly 32-bit machines) can (very slowly) handle I/O requests that exceed maxphys. Thanks to everyone who helped sort out the problems and the fixes. Reported by: Cy Schubert, David Wolfskill Diagnosis by: Mark Johnston, John Baldwin Reviewed by: Warner Losh Tested by: Cy Schubert, David Wolfskill MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-01 02:55:54 +00:00
* With file system clustering it is possible to allocate
* many contiguous blocks. The kernel variable maxphys defines
* the maximum transfer size permitted by the controller and/or
* buffering. The fs_maxcontig parameter controls the maximum
* number of blocks that the filesystem will read or write
* in a single transfer. It is calculated when the filesystem
* is created as maxphys / fs_bsize. The loader uses a maxphys
* of 128K even when running on a system that supports larger
* values. If the filesystem was built on a system that supports
* a larger maxphys (1M is typical) it will have configured
* fs_maxcontig for that larger system. So we bound the upper
* allowable limit for fs_maxconfig to be able to at least
* work with a 1M maxphys on the smallest block size filesystem:
* 1M / 4096 == 256. There is no harm in allowing the mounting of
* filesystems that make larger than maxphys I/O requests because
* those (mostly 32-bit machines) can (very slowly) handle I/O
* requests that exceed maxphys.
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
*/
Identify each UFS/FFS superblock integrity check as a warning or fatal error. Identify each of the superblock validation checks as either a warning or a fatal error. Any integrity check that can cause a system hang or crash is marked as fatal. Those that may simply lead to poor file layoutor other less good operating conditions are marked as warning. Normally both fatal and warning are treated as errors and prevent the superblock from being loaded. A new flag, UFS_NOWARNFAIL, is added. When passed to ffs_sbget() it will note warnings that it finds, but will still proceed with loading the superblock. Note that when UFS_NOWARNFAIL is used, it also includes UFS_NOHASHFAIL. No legitimate superblocks should fail as a result of these changes.
2022-08-01 05:07:20 +00:00
WCHK(fs->fs_maxcontig, <, 0, %jd);
WCHK(fs->fs_maxcontig, >, MAX(256, maxphys / fs->fs_bsize), %jd);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
FCHK2(fs->fs_maxcontig, ==, 0, fs->fs_contigsumsize, !=, 0, %jd);
FCHK2(fs->fs_maxcontig, >, 1, fs->fs_contigsumsize, !=,
When a superblock integrity check fails, report the cause of the failure. No functional change intended. MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219
2022-06-24 00:39:05 +00:00
MIN(fs->fs_maxcontig, FS_MAXCONTIG), %jd);
Add a flags parameter to the ffs_sbget() function that reads UFS superblocks. Rather than trying to shoehorn flags into the requested superblock address, create a separate flags parameter to the ffs_sbget() function in sys/ufs/ffs/ffs_subr.c. The ffs_sbget() function is used both in the kernel and in user-level utilities through export to the sbget() function in the libufs(3) library (see sbget(3) for details). The kernel uses ffs_sbget() when mounting UFS filesystems, in the glabel(8) and gjournal(8) GEOM utilities, and in the standalone library used when booting the system from a UFS root filesystem. The ffs_sbget() function reads the superblock located at the byte offset specified by its sblockloc parameter. The value UFS_STDSB may be specified for sblockloc to request that the standard location for the superblock be read. The two existing options are now flags: UFS_NOHASHFAIL will note if the check hash is wrong but will still return the superblock. This is used by the bootstrap code to give the system a chance to come up so that fsck can be run to correct the problem. UFS_NOMSG indicates that superblock inconsistency error messages should not be printed. It is used by programs like fsck that want to print their own error message and programs like glabel(8) that just want to know if a UFS filesystem exists on a partition. One additional flag is added: UFS_NOCSUM causes only the superblock itself to be returned, but does not read in any auxiliary data structures like the cylinder group summary information. It is used by clients like glabel(8) that just want to check for possible filesystem types. Using UFS_NOCSUM skips the superblock checks for csum data which allows superblocks that have corrupted csum data to be read and used. The validate_sblock() function checks that the superblock has not been corrupted in a way that can crash or hang the system. Unless the UFS_NOMSG flag is specified, it will print out any errors that it finds. Prior to this commit, validate_sblock() returned as soon as it found an inconsistency so would print at most one message. It now does all its checks so when UFS_NOMSG has not been specified will print out everything that it finds inconsistent. Sponsored by: The FreeBSD Foundation
2022-07-31 05:44:01 +00:00
return (error);
Do comprehensive UFS/FFS superblock integrity checks when reading a superblock. Historically only minimal checks were made of a superblock when it was read in as it was assumed that fsck would have been run to correct any errors before attempting to use the filesystem. Recently several bug reports have been submitted reporting kernel panics that can be triggered by deliberately corrupting filesystem superblocks, see Bug 263979 - [meta] UFS / FFS / GEOM crash (panic) tracking which is tracking the reported corruption bugs. This change upgrades the checks that are performed. These additional checks should prevent panics from a corrupted superblock. Although it appears in only one place, the new code will apply to the kernel modules and (through libufs) user applications that read in superblocks. Reported by: Robert Morris and Neeraj Reviewed by: kib Tested by: Peter Holm PR: 263979 MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D35219
2022-05-27 19:21:11 +00:00
}
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
/*
* Make an extensive search to find a superblock. If the superblock
* in the standard place cannot be used, try looking for one of the
* backup superblocks.
*
* Flags are made up of the following or'ed together options:
*
* UFS_NOMSG indicates that superblock inconsistency error messages
* should not be printed.
*
* UFS_NOCSUM causes only the superblock itself to be returned, but does
* not read in any auxillary data structures like the cylinder group
* summary information.
*/
int
ffs_sbsearch(void *devfd, struct fs **fsp, int reqflags,
struct malloc_type *filltype,
int (*readfunc)(void *devfd, off_t loc, void **bufp, int size))
{
struct fsrecovery *fsr;
struct fs *protofs;
void *fsrbuf;
char *cp;
long nocsum, flags, msg, cg;
off_t sblk, secsize;
int error;
msg = (reqflags & UFS_NOMSG) == 0;
nocsum = reqflags & UFS_NOCSUM;
/*
* Try normal superblock read and return it if it works.
*
* Suppress messages if it fails until we find out if
* failure can be avoided.
*/
flags = UFS_NOMSG | nocsum;
if (ffs_sbget(devfd, fsp, UFS_STDSB, flags, filltype, readfunc) == 0)
return (0);
/*
* First try: ignoring hash failures.
*/
flags |= UFS_NOHASHFAIL;
if (msg)
flags &= ~UFS_NOMSG;
if (ffs_sbget(devfd, fsp, UFS_STDSB, flags, filltype, readfunc) == 0)
return (0);
/*
* Next up is to check if fields of the superblock that are
* needed to find backup superblocks are usable.
*/
if (msg)
printf("Attempted recovery for standard superblock: failed\n");
flags = UFS_FSRONLY | UFS_NOHASHFAIL | UFS_NOMSG;
if (ffs_sbget(devfd, &protofs, UFS_STDSB, flags, filltype,
readfunc) == 0) {
if (msg)
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
printf("Attempt extraction of recovery data from "
"standard superblock.\n");
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
} else {
/*
* Final desperation is to see if alternate superblock
* parameters have been saved in the boot area.
*/
if (msg)
printf("Attempted extraction of recovery data from "
"standard superblock: failed\nAttempt to find "
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
"boot zone recovery data.\n");
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
/*
* Look to see if recovery information has been saved.
* If so we can generate a prototype superblock based
* on that information.
*
* We need fragments-per-group, number of cylinder groups,
* location of the superblock within the cylinder group, and
* the conversion from filesystem fragments to disk blocks.
*
* When building a UFS2 filesystem, newfs(8) stores these
* details at the end of the boot block area at the start
* of the filesystem partition. If they have been overwritten
* by a boot block, we fail. But usually they are there
* and we can use them.
*
* We could ask the underlying device for its sector size,
* but some devices lie. So we just try a plausible range.
*/
error = ENOENT;
for (secsize = dbtob(1); secsize <= SBLOCKSIZE; secsize *= 2)
if ((error = (*readfunc)(devfd, (SBLOCK_UFS2 - secsize),
&fsrbuf, secsize)) == 0)
break;
if (error != 0)
goto trynowarn;
cp = fsrbuf; /* type change to keep compiler happy */
fsr = (struct fsrecovery *)&cp[secsize - sizeof *fsr];
if (fsr->fsr_magic != FS_UFS2_MAGIC ||
(protofs = UFS_MALLOC(SBLOCKSIZE, filltype, M_NOWAIT))
== NULL) {
UFS_FREE(fsrbuf, filltype);
goto trynowarn;
}
memset(protofs, 0, sizeof(struct fs));
protofs->fs_fpg = fsr->fsr_fpg;
protofs->fs_fsbtodb = fsr->fsr_fsbtodb;
protofs->fs_sblkno = fsr->fsr_sblkno;
protofs->fs_magic = fsr->fsr_magic;
protofs->fs_ncg = fsr->fsr_ncg;
UFS_FREE(fsrbuf, filltype);
}
/*
* Scan looking for alternative superblocks.
*/
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
flags = nocsum;
if (!msg)
flags |= UFS_NOMSG;
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
for (cg = 0; cg < protofs->fs_ncg; cg++) {
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
sblk = fsbtodb(protofs, cgsblock(protofs, cg));
if (msg)
printf("Try cg %ld at sblock loc %jd\n", cg,
(intmax_t)sblk);
if (ffs_sbget(devfd, fsp, dbtob(sblk), flags, filltype,
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
readfunc) == 0) {
if (msg)
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
printf("Succeeded with alternate superblock "
"at %jd\n", (intmax_t)sblk);
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
UFS_FREE(protofs, filltype);
return (0);
}
}
UFS_FREE(protofs, filltype);
/*
* Our alternate superblock strategies failed. Our last ditch effort
* is to see if the standard superblock has only non-critical errors.
*/
trynowarn:
flags = UFS_NOWARNFAIL | UFS_NOMSG | nocsum;
if (msg) {
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
printf("Finding an alternate superblock failed.\nCheck for "
"only non-critical errors in standard superblock\n");
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
flags &= ~UFS_NOMSG;
}
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
if (ffs_sbget(devfd, fsp, UFS_STDSB, flags, filltype, readfunc) != 0) {
if (msg)
printf("Failed, superblock has critical errors\n");
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
return (ENOENT);
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
}
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
if (msg)
Updates to UFS/FFS superblock integrity checks when reading a superblock. Further updates based on ways Peter Holm found to corrupt UFS superblocks in ways that could cause kernel hangs or crashes. No legitimate superblocks should fail as a result of these changes. Reported by: Peter Holm Tested by: Peter Holm Sponsored by: The FreeBSD Foundation
2022-08-26 07:09:01 +00:00
printf("Success, using standard superblock with "
"non-critical errors.\n");
Move the ability to search for alternate UFS superblocks from fsck_ffs(8) into ffs_sbsearch() to allow use by other parts of the system. Historically only fsck_ffs(8), the UFS filesystem checker, had code to track down and use alternate UFS superblocks. Since fsdb(8) used much of the fsck_ffs(8) implementation it had some ability to track down alternate superblocks. This change extracts the code to track down alternate superblocks from fsck_ffs(8) and puts it into a new function ffs_sbsearch() in sys/ufs/ffs/ffs_subr.c. Like ffs_sbget() and ffs_sbput() also found in ffs_subr.c, these functions can be used directly by the kernel subsystems. Additionally they are exported to the UFS library, libufs(8) so that they can be used by user-level programs. The new functions added to libufs(8) are sbfind(3) that is an alternative to sbread(3) and sbsearch(3) that is an alternative to sbget(3). See their manual pages for further details. The utilities that have been changed to search for superblocks are dumpfs(8), fsdb(8), ffsinfo(8), and fsck_ffs(8). Also, the prtblknos(8) tool found in tools/diag/prtblknos searches for superblocks. The UFS specific mount code uses the superblock search interface when mounting the root filesystem and when the administrator doing a mount(8) command specifies the force flag (-f). The standalone UFS boot code (found in stand/libsa/ufs.c) uses the superblock search code in the hope of being able to get the system up and running so that fsck_ffs(8) can be used to get the filesystem cleaned up. The following utilities have not been changed to search for superblocks: clri(8), tunefs(8), snapinfo(8), fstyp(8), quot(8), dump(8), fsirand(8), growfs(8), quotacheck(8), gjournal(8), and glabel(8). When these utilities fail, they do report the cause of the failure. The one exception is the tasting code used to try and figure what a given disk contains. The tasting code will remain silent so as not to put out a slew of messages as it trying to taste every new mass storage device that shows up. Reviewed by: kib Reviewed by: Warner Losh Tested by: Peter Holm Differential Revision: https://reviews.freebsd.org/D36053 Sponsored by: The FreeBSD Foundation
2022-08-13 19:41:53 +00:00
return (0);
}
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
/*
* Write a superblock to the devfd device from the memory pointed to by fs.
* Write out the superblock summary information if it is present.
*
* If the write is successful, zero is returned. Otherwise one of the
* following error values is returned:
* EIO: failed to write superblock.
* EIO: failed to write superblock summary information.
*/
int
ffs_sbput(void *devfd, struct fs *fs, off_t loc,
int (*writefunc)(void *devfd, off_t loc, void *buf, int size))
{
int i, error, blks, size;
uint8_t *space;
/*
* If there is summary information, write it first, so if there
* is an error, the superblock will not be marked as clean.
*/
Move the pointers stored in the superblock into a separate fs_summary_info structure. This change was originally done by the CheriBSD project as they need larger pointers that do not fit in the existing superblock. This cleanup of the superblock eases the task of the commit that immediately follows this one. Suggested by: brooks Reviewed by: kib PR: 246983 Sponsored by: Netflix
2020-06-19 01:02:53 +00:00
if (fs->fs_si != NULL && fs->fs_csp != NULL) {
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
blks = howmany(fs->fs_cssize, fs->fs_fsize);
space = (uint8_t *)fs->fs_csp;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
if (i + fs->fs_frag > blks)
size = (blks - i) * fs->fs_fsize;
if ((error = (*writefunc)(devfd,
dbtob(fsbtodb(fs, fs->fs_csaddr + i)),
space, size)) != 0)
return (error);
space += size;
}
}
fs->fs_fmod = 0;
The binary representation of the superblock (the fs structure) is written out verbatim to the disk: see ffs_sbput() in sys/ufs/ffs/ffs_subr.c. It contains a pointer to the fs_summary_info structure. This pointer value inadvertently causes garbage to be stored. It is garbage because the pointer to the fs_summary_info structure is the address the then current stack or heap. Although a mere pointer does not reveal anything useful (like a part of a private key) to an attacker, garbage output deteriorates reproducibility. This commit zeros out the pointer to the fs_summary_info structure before writing the out the superblock. Reviewed by: kib Tested by: Peter Holm PR: 246983 Sponsored by: Netflix
2020-06-19 01:04:25 +00:00
#ifndef _KERNEL
{
struct fs_summary_info *fs_si;
fs->fs_time = time(NULL);
/* Clear the pointers for the duration of writing. */
fs_si = fs->fs_si;
fs->fs_si = NULL;
fs->fs_ckhash = ffs_calc_sbhash(fs);
error = (*writefunc)(devfd, loc, fs, fs->fs_sbsize);
fs->fs_si = fs_si;
}
#else /* _KERNEL */
fs->fs_time = time_second;
Calculate updated superblock check-hash before writing it into the snapshot. This corrects a bug that prevented snapshots from being mounted due to a superblock check-hash failure. Reported by: Brennan Vincent <brennan@umanwizard.com> Tested by: Peter Holm (pho@) Sponsored by: Netflix
2018-11-25 18:01:15 +00:00
fs->fs_ckhash = ffs_calc_sbhash(fs);
The binary representation of the superblock (the fs structure) is written out verbatim to the disk: see ffs_sbput() in sys/ufs/ffs/ffs_subr.c. It contains a pointer to the fs_summary_info structure. This pointer value inadvertently causes garbage to be stored. It is garbage because the pointer to the fs_summary_info structure is the address the then current stack or heap. Although a mere pointer does not reveal anything useful (like a part of a private key) to an attacker, garbage output deteriorates reproducibility. This commit zeros out the pointer to the fs_summary_info structure before writing the out the superblock. Reviewed by: kib Tested by: Peter Holm PR: 246983 Sponsored by: Netflix
2020-06-19 01:04:25 +00:00
error = (*writefunc)(devfd, loc, fs, fs->fs_sbsize);
#endif /* _KERNEL */
return (error);
Refactoring of reading and writing of the UFS/FFS superblock. Specifically reading is done if ffs_sbget() and writing is done in ffs_sbput(). These functions are exported to libufs via the sbget() and sbput() functions which then used in the various filesystem utilities. This work is in preparation for adding subperblock check hashes. No functional change intended. Reviewed by: kib
2018-01-26 00:58:32 +00:00
}
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
/*
* Calculate the check-hash for a superblock.
*/
Calculate updated superblock check-hash before writing it into the snapshot. This corrects a bug that prevented snapshots from being mounted due to a superblock check-hash failure. Reported by: Brennan Vincent <brennan@umanwizard.com> Tested by: Peter Holm (pho@) Sponsored by: Netflix
2018-11-25 18:01:15 +00:00
uint32_t
ffs_calc_sbhash(struct fs *fs)
Continuing efforts to provide hardening of FFS, this change adds a check hash to the superblock. If a check hash fails when an attempt is made to mount a filesystem, the mount fails with EINVAL (Invalid argument). This avoids a class of filesystem panics related to corrupted superblocks. The hash is done using crc32c. Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily used in embedded systems with small memories and low-powered processors which need as light-weight a filesystem as possible. Reviewed by: kib Tested by: Peter Holm Sponsored by: Netflix
2018-10-23 21:10:06 +00:00
{
uint32_t ckhash, save_ckhash;
/*
* A filesystem that was using a superblock ckhash may be moved
* to an older kernel that does not support ckhashes. The
* older kernel will clear the FS_METACKHASH flag indicating
* that it does not update hashes. When the disk is moved back
* to a kernel capable of ckhashes it disables them on mount:
*
* if ((fs->fs_flags & FS_METACKHASH) == 0)
* fs->fs_metackhash = 0;
*
* This leaves (fs->fs_metackhash & CK_SUPERBLOCK) == 0) with an
* old stale value in the fs->fs_ckhash field. Thus the need to
* just accept what is there.
*/
if ((fs->fs_metackhash & CK_SUPERBLOCK) == 0)
return (fs->fs_ckhash);
save_ckhash = fs->fs_ckhash;
fs->fs_ckhash = 0;
/*
* If newly read from disk, the caller is responsible for
* verifying that fs->fs_sbsize <= SBLOCKSIZE.
*/
ckhash = calculate_crc32c(~0L, (void *)fs, fs->fs_sbsize);
fs->fs_ckhash = save_ckhash;
return (ckhash);
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
/*
Remove trailing whitespace.
1995-05-30 08:16:23 +00:00
* Update the frsum fields to reflect addition or deletion
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
* of some frags.
*/
void
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
ffs_fragacct(struct fs *fs, int fragmap, int32_t fraglist[], int cnt)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
{
int inblk;
Remove register keyword. Sponsored by: DARPA & NAI Labs. Submitted by: mckusick
2002-05-13 09:22:31 +00:00
int field, subfield;
int siz, pos;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
inblk = (int)(fragtbl[fs->fs_frag][fragmap]) << 1;
fragmap <<= 1;
for (siz = 1; siz < fs->fs_frag; siz++) {
if ((inblk & (1 << (siz + (fs->fs_frag % NBBY)))) == 0)
continue;
field = around[siz];
subfield = inside[siz];
for (pos = siz; pos <= fs->fs_frag; pos++) {
if ((fragmap & field) == subfield) {
fraglist[siz] += cnt;
pos += siz;
field <<= siz;
subfield <<= siz;
}
field <<= 1;
subfield <<= 1;
}
}
}
/*
* block operations
*
* check if a block is available
*/
int
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
ffs_isblock(struct fs *fs, unsigned char *cp, ufs1_daddr_t h)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
{
unsigned char mask;
switch ((int)fs->fs_frag) {
case 8:
return (cp[h] == 0xff);
case 4:
mask = 0x0f << ((h & 0x1) << 2);
return ((cp[h >> 1] & mask) == mask);
case 2:
mask = 0x03 << ((h & 0x3) << 1);
return ((cp[h >> 2] & mask) == mask);
case 1:
mask = 0x01 << (h & 0x7);
return ((cp[h >> 3] & mask) == mask);
default:
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
#ifdef _KERNEL
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
panic("ffs_isblock");
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
#endif
break;
}
return (0);
}
/*
* check if a block is free
*/
int
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
ffs_isfreeblock(struct fs *fs, u_char *cp, ufs1_daddr_t h)
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
{
ufs: clean up empty lines in .c and .h files
2020-09-01 21:23:00 +00:00
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
switch ((int)fs->fs_frag) {
case 8:
return (cp[h] == 0);
case 4:
return ((cp[h >> 1] & (0x0f << ((h & 0x1) << 2))) == 0);
case 2:
return ((cp[h >> 2] & (0x03 << ((h & 0x3) << 1))) == 0);
case 1:
return ((cp[h >> 3] & (0x01 << (h & 0x7))) == 0);
default:
#ifdef _KERNEL
panic("ffs_isfreeblock");
#endif
break;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
}
Fixes to track snapshot copy-on-write checking in the specinfo structure rather than assuming that the device vnode would reside in the FFS filesystem (which is obviously a broken assumption with the device filesystem).
2001-03-07 07:09:55 +00:00
return (0);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
}
/*
* take a block out of the map
*/
void
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
ffs_clrblock(struct fs *fs, u_char *cp, ufs1_daddr_t h)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
{
switch ((int)fs->fs_frag) {
case 8:
cp[h] = 0;
return;
case 4:
cp[h >> 1] &= ~(0x0f << ((h & 0x1) << 2));
return;
case 2:
cp[h >> 2] &= ~(0x03 << ((h & 0x3) << 1));
return;
case 1:
cp[h >> 3] &= ~(0x01 << (h & 0x7));
return;
default:
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
#ifdef _KERNEL
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
panic("ffs_clrblock");
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
#endif
break;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
}
}
/*
* put a block into the map
*/
void
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
ffs_setblock(struct fs *fs, unsigned char *cp, ufs1_daddr_t h)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
{
switch ((int)fs->fs_frag) {
case 8:
cp[h] = 0xff;
return;
case 4:
cp[h >> 1] |= (0x0f << ((h & 0x1) << 2));
return;
case 2:
cp[h >> 2] |= (0x03 << ((h & 0x3) << 1));
return;
case 1:
cp[h >> 3] |= (0x01 << (h & 0x7));
return;
default:
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
#ifdef _KERNEL
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
panic("ffs_setblock");
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
#endif
break;
}
}
/*
* Update the cluster map because of an allocation or free.
*
* Cnt == 1 means free; cnt == -1 means allocating.
*/
void
ANSIfy ffs_subr.c Also renumber license clause to avoid skipping #3
2016-10-31 20:43:43 +00:00
ffs_clusteracct(struct fs *fs, struct cg *cgp, ufs1_daddr_t blkno, int cnt)
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
{
int32_t *sump;
int32_t *lp;
u_char *freemapp, *mapp;
Import commit from NetBSD with checkin message: Avoid Undefined Behavior in ffs_clusteracct() Change the type of 'bit' variable from int to unsigned int and use unsigned values consistently. sys/ufs/ffs/ffs_subr.c:336:10, shift exponent -1 is negative Detected with Kernel Undefined Behavior Sanitizer. Reported by <Harry Pantazis> Submitted by: Pedro Giffuni
2018-07-07 19:11:43 +00:00
int i, start, end, forw, back, map;
u_int bit;
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
if (fs->fs_contigsumsize <= 0)
return;
freemapp = cg_clustersfree(cgp);
sump = cg_clustersum(cgp);
/*
* Allocate or clear the actual block.
*/
if (cnt > 0)
setbit(freemapp, blkno);
else
clrbit(freemapp, blkno);
/*
* Find the size of the cluster going forward.
*/
start = blkno + 1;
end = start + fs->fs_contigsumsize;
if (end >= cgp->cg_nclusterblks)
end = cgp->cg_nclusterblks;
mapp = &freemapp[start / NBBY];
map = *mapp++;
Import commit from NetBSD with checkin message: Avoid Undefined Behavior in ffs_clusteracct() Change the type of 'bit' variable from int to unsigned int and use unsigned values consistently. sys/ufs/ffs/ffs_subr.c:336:10, shift exponent -1 is negative Detected with Kernel Undefined Behavior Sanitizer. Reported by <Harry Pantazis> Submitted by: Pedro Giffuni
2018-07-07 19:11:43 +00:00
bit = 1U << (start % NBBY);
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
for (i = start; i < end; i++) {
if ((map & bit) == 0)
break;
if ((i & (NBBY - 1)) != (NBBY - 1)) {
bit <<= 1;
} else {
map = *mapp++;
bit = 1;
}
}
forw = i - start;
/*
* Find the size of the cluster going backward.
*/
start = blkno - 1;
end = start - fs->fs_contigsumsize;
if (end < 0)
end = -1;
mapp = &freemapp[start / NBBY];
map = *mapp--;
Import commit from NetBSD with checkin message: Avoid Undefined Behavior in ffs_clusteracct() Change the type of 'bit' variable from int to unsigned int and use unsigned values consistently. sys/ufs/ffs/ffs_subr.c:336:10, shift exponent -1 is negative Detected with Kernel Undefined Behavior Sanitizer. Reported by <Harry Pantazis> Submitted by: Pedro Giffuni
2018-07-07 19:11:43 +00:00
bit = 1U << (start % NBBY);
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
for (i = start; i > end; i--) {
if ((map & bit) == 0)
break;
if ((i & (NBBY - 1)) != 0) {
bit >>= 1;
} else {
map = *mapp--;
Import commit from NetBSD with checkin message: Avoid Undefined Behavior in ffs_clusteracct() Change the type of 'bit' variable from int to unsigned int and use unsigned values consistently. sys/ufs/ffs/ffs_subr.c:336:10, shift exponent -1 is negative Detected with Kernel Undefined Behavior Sanitizer. Reported by <Harry Pantazis> Submitted by: Pedro Giffuni
2018-07-07 19:11:43 +00:00
bit = 1U << (NBBY - 1);
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
}
- Merge soft-updates journaling from projects/suj/head into head. This brings in support for an optional intent log which eliminates the need for background fsck on unclean shutdown. Sponsored by: iXsystems, Yahoo!, and Juniper. With help from: McKusick and Peter Holm
2010-04-24 07:05:35 +00:00
back = start - i;
/*
* Account for old cluster and the possibly new forward and
* back clusters.
*/
i = back + forw + 1;
if (i > fs->fs_contigsumsize)
i = fs->fs_contigsumsize;
sump[i] += cnt;
if (back > 0)
sump[back] -= cnt;
if (forw > 0)
sump[forw] -= cnt;
/*
* Update cluster summary information.
*/
lp = &sump[fs->fs_contigsumsize];
for (i = fs->fs_contigsumsize; i > 0; i--)
if (*lp-- > 0)
break;
fs->fs_maxcluster[cgp->cg_cgx] = i;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
}
Reference in New Issue Copy Permalink